HOWTO make
sysklogd (syslogd) listen on multiple portswritten by John Newbigin
jn@it.swin.edu.au

What is this page about

At out site, all the linux boxes use remote logging
so we can collate the logs on a central server. This works well for
a small number of machines but now we want to separate into groups of
machines (servers, staff & students). Unfortunately the syslogd
from sysklogd reads a port number only from /etc/services and we can't
control the interface which it binds to.

One solution would be to modify the code to solve
one or both of these issues but I was looking for a way which did not
require source modification. The solution was to use a chroot
environment.

Setting up the chroot

First I will present the commands required for
setting this up on Red Hat Enterprise Linux 2.1, then I will list some
techniques for working out any steps for yourself. In the statement
below, the # indicates a root shell prompt which you should not type in.

The daemon can then be started with this command# chroot /var/log/virtual/student
/sbin/syslogd -r

You can control the port that syslogd will use by
editing etc/services and modifying the syslog port number. You
should probably use debug mode to make sure that things are working.
To do that, start stunnel with the -d parameter# chroot /var/log/virtual/student
/sbin/syslogd -d -r

If you get errors about missing libraries or file
not found errors, your syslogd binary might be linked against different
libraries than mine (this is quite possible if you are not running
RHEL21). If so you can get a
list of libraries by using the ldd command
# ldd /sbin/syslogd
libc.so.6 => /lib/i686/libc.so.6 (0x40029000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

For each library listed, copy it into the lib
directory. Don't worry about using subdirectories like i686 unless
you are really anal and want to set up the symlinks.

Because parts of libc are dynamically loaded at run
time, you may
require libraries which are not listed by ldd. The easy way to find
out what you need it to use strace. Install strace in your chroot
and then run syslogd

Library loads will be shown like thisopen("/lib/libnss_files.so.2", O_RDONLY) = 3
If the file can't be found then you will get errors like thisopen("/lib/mmx/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)Some errors are OK, others indicate problems.
You will also see requests to open config files like /etc/hosts etc.
Again, some are required and others are not necessary. You just have
to play around till you get the right ones (or RTFM/use the source/ask
your local Guru etc.).

Once you have everything set up, write an init
script to start everything up the way you want it and your server side is
done.

The client side is quite simple, just edit the
syslog port number in /etc/services. You can do this with a simple
(?) perl command. This command will change the port number to 1234.

For the truly lazy (download)

Other things to do

logrotate

You probably want to rotate the virtual logs
too. In /etc/logrotate.d make a copy of syslog called syslog_<virtual
name> for each of your virtual hosts. Edit the file and prepend
the /var/log/<virtual name> to each of the log file names and the .pid
file name

logcheck

If you run psionic logcheck then you can easily edit
logcheck.sh to use a virtual directory. Again if you are lazy you
can download my custom version